SSL certificate issuance failed:

Domain verifies but SSL cert fails, tried different subdomains like .api and .aw, used cname and CAA, no prior CAA existed on website, tried Multiple CAAs at once, certainly, letsencrypt etc didnt work either, mainly want it to fix 3 party cookies issue, DNS managed by spaceship

TL;DR

SSL certificate issuance failed due to a mismatch in CAA requirements between the system and Cloudflare. Initially suggested to try adding specific CAA entries manually or remove the CAA altogether for broader validation. Eventually, a fix was implemented affecting specific regions, resolving the issue for some users.

Hello @TikZ.- going to look into you're issue. Thanks for the information so far, I'll get back to you if I have some information or need more information from you.

<@237572985370705920> Could you try again, not entirely sure the mitigation I did will fix your issue. So far the error seems to indicate that the problem is between our system and Cloudflare not so much your configuration.

nope getting same error

should i keep or remove all other CAAs except certainly

Could you try it with just 0 issue "certainly.com" to see if that would work

same issue

Okay then it might be that it doesnt match in terms of CAA that cloudflare requires and the authentication error is a generic answer. For example if I set the CAA value to just certainly, cloudflare will automatically add these other CAA - example:

And I think spaceship doesn't do that for you automatically.

As a last try you could maybe remove the CAA althogether to see if that allows the creation, and otherwise add the records that Cloudflare requires like the above.

i have tried this before, so basically i should add all these entries manually ? 11?

Either that or remove the CAA record all together which should allow any certificate authority, but that is less secure.

<@238591617794048000> still same issue

Any news? I'm getting the same error and my app is not accesible🫠

I've tried also this 🙁

<@419519167117524993> ye its kinda annoying especially no guarantees if in prod it will work for all users or just silently fail due to third party

Did you find any solution?

It's annoying because my app published on App Store has this not valid endpoint, so if I want to change it I have to send it to review again, and it means some days with my app offline...

nope no idea, we cant do much to fix it from here though something seems to be wrong on their end or cloudflares

Hey folks 👋 Ill make sure this gets resolved today, or post progress if its bigger issue than we expect.

Since it affects two people, Ill start by trying to reproduce, hopefully I can see same on staging. <@237572985370705920> Its not clear from screenshot - are you adding custom domain to site, function, or in project settings?